0

Recently, I signed up on this website. As soon as I registered, they sent me an activation email.

After seeing the activation email, I was a little disturbed. The activation email consisted of the following info:

  • Activation URL
  • Username
  • Password

Yes, they explicitly mentioned my password in the activation email.

This is very bad practice because of the following reasons:

  • If I have made a typo in my email then the person who receives the email gets to know my really sensitive info.
  • Even if typo is not there, but let's say, somehow someone manages to get access to my email, he will also now get access to my information on this new website where I registered.

Moreover, to the best of my knowledge, user sign-up forms are designed such that the party offering the service doesn't themselves get access to my password (this is usually done by first encrypting the password - one way hashing - and then storing it). But since they sent my password back again to my email, so it is possible that they indeed have access to my actual password.

I have submitted a query to them regarding this issue but I am not sure if some action will be taken soon or not.

So, I would like to know, in case they don't take any action at all, where can I submit my complaint regarding this?

Besides, I am not very confident if I can actually register a complaint because there terms and conditions page doesn't talk about anything related to this. And also, they never asked me if I agree to those terms and conditions.

Improve this question
7
  • You agree to the terms and conditions when you signed up. Complaints if at all possible would be directed to a body in your jurisdiction, which is neither relevant to the terms nor remotely the same thing in every jurisdiction.
    – user4657
    Jun 12, 2018 at 19:51
  • 1
    Where are you located? Where is the service located?
    – phoog
    Jun 12, 2018 at 23:19
  • 1
    "user sign-up forms are designed such that the party offering the service doesn't themselves get access to my password (this is usually done by first encrypting the password - one way hashing - and then storing it)." You'd be surprised (and probably disturbed) by how many sites don't follow this policy. Always use a unique password for every site! (Password managers help with this.)
    – JAB
    Jun 12, 2018 at 23:22
  • @Nij Neither there was some sought of checkbox (as in most websites) that I had to check to agree to the terms and conditions while signing up, nor there was anywhere mentioned that I agree to them by signing up
    – kishlaya
    Jun 13, 2018 at 4:56
  • @phoog I am in India and I guess this is an Indian service as well.
    – kishlaya
    Jun 13, 2018 at 4:57

2 Answers 2

Reset to default
3

Because the company that runs the contest is not in the banking or medical industry, or in another business or organization (NGO or governmental) that has to protect personal information by law, your login, email and password can be stored on pieces of paper scattered around their office and it's not illegal. And there are no laws regarding sending your information in plain text in an email.

Yes, those are bad security and privacy policies, but they are not illegal. (This may vary by jurisdiction).

The TOS (Terms of Serivice) you agreed to are at Eye Win Awards Privacy Policy. Part of it reads:

By providing us your Information or by making use of the facilities provided by the Website, You hereby consent to the collection, storage, processing and transfer of any or all of Your Personal Information and Non-Personal Information by us as specified under this Privacy Policy. You further agree that such collection, use, storage and transfer of Your Information shall not cause any loss or wrongful gain to you or any other person.

and

We cannot guarantee the security of our database, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. And, of course, any information you include in a posting to the discussion areas is available to anyone with Internet access.

You agree to the TOS and Privacy Policy simply by registering and using the site. This is known as a click wrap (Wikipedia) contract. You can choose to stop using the service, or by the company can choose to void the contract and close your account.

You can complain, but it is entirely up to the company to address your complaint or even reply to you. The Grievance Redressal contact in India is at the bottom of the link above. There are probably consumer advocacy groups in India; Google will show you those.

Improve this answer
1
  • I should start reading Terms and Conditions more carefully now!!
    – kishlaya
    Jun 13, 2018 at 5:10
0

Depending on what you're hoping to get out of the process, you can complain to the company, the Federal Trade Commission, or the Better Business Bureau.

Improve this answer
1
  • The site is in India, the user is likely to be in India. BBB itself says that it does not do anything outside North America except for limited European exception, and the FTC has no jurisdiction outside the USA. This answer doesn't help the user at all.
    – user4657
    Jun 13, 2018 at 5:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .